The present invention relates to a system for controlling vehicle components, e.g., for steering a vehicle, according to the xe2x80x9cDrive by Wirexe2x80x9d principle.
The fundamental characteristic of a xe2x80x9cDrive by Wirexe2x80x9d vehicle is that a direct, mechanical connection exists neither between the foot controls and the corresponding components (gas, brake, clutch), nor between the steering wheel and the wheels coupled to it. The control measures taken by the driver are no longer directly converted into mechanical displacements, but are picked up by sensors at the pedals and the steering wheel, electronically processed by control computers, and transmitted as an electrical, controlled variable to the corresponding actuators.
The advantages of a xe2x80x9cDrive By Wirexe2x80x9d system include, inter alia, the increase in passive safety, since, e.g., the elimination of a steering column excludes it from intruding into the vehicle interior. In addition, the comfort of the vehicle can be improved, because, e.g., it is possible to freely select the restoring torque at the steering wheel and vary the transmission ratio between the steering wheel and the wheels coupled to it. There are also design advantages. This facilitates, for example, the construction of right-hand/left-hand steering designs, as well as their selection, and also facilitates the conversion to driving-school vehicles or disabled-friendly vehicles. Furthermore, xe2x80x9cDrive By Wirexe2x80x9d systems simplify the system integration of devices such as a vehicle stability control system, anti-lock braking system, traction control system, automatic speed control, etc., which means that the costs can be correspondingly reduced.
On the other hand, a xe2x80x9cBy Wirexe2x80x9d system has, however, the problem that a transition into a safe state is not ensured in the event of a fault in one of its components. In contrast to, e.g., conventional power-assisted steering, which still retains the basic steering function in the event of a fault that leads to the failure of the servo assistance of the steering, the malfunction of a component in a xe2x80x9cBy Wirexe2x80x9d system can have fatal consequences if design or conceptional safety measures are not taken.
A hydraulic steering device is described in U.S. Pat. No. 4,771,846. The hydraulic steering device is supplied with pressurized hydraulic fluid by a pump, via a proportional valve. The proportional system is controlled with the aid of an electromagnet, using signals picked up by a steering-angle sensor. In this context, the proportional valve is controlled so that the value specified by the steering-angle sensor is set at the steered wheels. In this case, it is disadvantageous that the entire steering system fails when the proportional valve ceases to operate.
A further steering system is described in German Published Patent Application No. 35 36 563, where the movement of a steering handwheel starts an electric motor, using switching electronics. The electric motor drives a pump, which is connected to working chambers of a working cylinder. In this context, the rotational direction of the pump determines the direction in which the working cylinder is displaced. This system is also not redundant and runs the risk of complete failure.
In addition, German Published Patent Application No. 40 11 947 describes a steering system for two steerable wheels, where the wheels can be steered independently of each other. The individual wheels are driven by a servomotor, which is powered by an electronic control unit. In this case, there is also the danger of the vehicle no longer being steerable in response to the servomotor or the electronic control unit failing.
A steering system, which controls at least two independent motors with the aid of at least two independent control units, is described in German Published Patent Application No. 42 41 849. Safe operation is ensured by fault monitoring and redundancy in the motors. A fault-monitoring device prevents a defective control unit from controlling the steering elements. However, it is disadvantageous that incorrect steering is triggered by any undetected faults in the control units.
It is an object of the present invention to provide a xe2x80x9cDrive By Wirexe2x80x9d system, e.g., for steering a vehicle, which passes over into a safe operating state in the event of one of its components malfunctioning in a manner that is critical with regard to safety.
This object is achieved by providing a system as described herein. One example embodiment of the system of the present invention accordingly includes at least one steerable wheel, a steering wheel or equivalent steering device, an odd number of more than one intercommunicating control computers which are each connected to at least one first sensor detecting a movement or actuation of the steering wheel or steering device and to at least one second sensor directly or indirectly detecting the position of the at least one steerable wheel, a first actuator and a second actuator which are each mechanically coupled to the at least one steerable wheel and may each be controlled by one of the control computers, a first voter-basis discriminator that is assigned to the first actuator, and a second voter-basis discriminator that is assigned to the second actuator. Each of the control computers transmits a first signal to the first voter-basis discriminator and a second signal different from the first signal to the second voter-basis discriminator. The actuator, the assigned voter-basis discriminator of which receives the first signal from the majority of the control computers, is actively controllable by its assigned control computer. Using model calculations and the measured values acquired by the sensors, the control computers ascertain their own state and the state of the system and, in each case, effect a switchover from the active control computer to the control computer assigned to the other actuator if the system function shows deviations from the model expectations of a majority of the control computers.
Therefore, the system components that are critical with regard to safety are configured with redundancy so that, in the case of a malfunctioning component, the system automatically switches over to a corresponding component that works correctly. In the control computers, a routine may be implemented which allows each controlling, control computer to formulate and transmit a switchover request to the other control computers, whereby the other control computers change their signals received by the voting-basis discriminators, so that another control-enabled control computer assumes control in the system, by then controlling the actuator assigned to it.
An example embodiment of the system according to the present invention provides for the control computers intercommunicating via a CAN bus. This may be advantageous, since a CAN bus operates in a substantially fault-tolerant manner, and independently of the CPU.
Another example embodiment of the system according to the present invention is characterized in that the actuators each possess a hydraulic control unit having a double-acting steering cylinder, the two cylinder chambers of each steering cylinder being interconnectable by a steering bypass valve. In each case, this arrangement may allow one of the redundant steering cylinders to be switched on or switched off in a simple and reliable manner. In this context, the voter-basis discriminators control the steering bypass valves and thus establish which hydraulic circuit is active at any one time.
Another example embodiment of the present invention provides for the pressure in each of the two cylinder chambers of the dual-acting steering cylinder being adjustable, using a proportional valve, a separate pressure sensor being connected to each of the two cylinder chambers. In this context, each steering cylinder may be assigned its own pump for providing the necessary supply pressure.
The outlet of the pump may be connected to a pressure reservoir, via a non-return valve. Therefore, the pump may not be continuously run during the operation of the vehicle. Along these lines, a pressure sensor may be provided for measuring the supply pressure, the pump being limited by the actively-controlling control computer in response to a predefined pressure value being reached.
In addition, a branch leading into a hydraulic-fluid tank may be connected to a pump bypass valve, between the outlet of the pump and the non-return valve. This allows the pump to start up without counterpressure from the system. In the case of an electric pump, this may prevent high starting currents.
A further example embodiment according to the present invention provides for one of the control computers controlling a steering-torque motor connected to the steering wheel, in order to simulate a restoring torque. In this context, the pressure difference between the two cylinder chambers of the double-acting steering cylinder is used as a basis for calculating the restoring torque at the steering wheel.
The system of the present invention may include a brake system, as well. The system may additionally include: a brake-pedal mechanism; a first wheel-brake cylinder and a second wheel-brake cylinder, which each belong to different brake circuits that each have a hydraulic control unit; as well as a number of third sensors corresponding to the odd number of more than one control computers; each third sensor detecting the position of the brake pedal and being connected to one of the control computers, so that each brake circuit is assigned a different control computer, by which the corresponding brake circuit may be controlled according to the xe2x80x9cBrake By Wirexe2x80x9d principle. In this case, the control computers and voting-basis discriminators present for the steering, as well as parts of the hydraulics, may be used for the brake system as well.
The brake system may be divided into two brake circuits that are independent of each other, each brake circuit having two wheel-brake cylinders, of which the one wheel-brake cylinder is assigned to a front wheel and the other wheel-brake cylinder is assigned to a rear wheel on the opposite side of the vehicle.